Security: sensitive data exposure in src/handlers/request-handlers/rate-limiter-middleware.ts #1015

CodeRabbit's historical security scan of this repository (scan e8c825ec-84c1-4a90-b646-61791714baf8, revision bc22677aba, generated 2026-11-01) reported this. It is an AI-generated finding, not a confirmed vulnerability: reachability is not established by the scan, and the report itself says so. Triage before treating it as exploitable.

F-017 — sensitive data exposure (medium)

src/handlers/request-handlers/rate-limiter-middleware.ts:15-15

Administrator HTTP requests write complete Cookie and Authorization headers into debug logs. Someone with access to these logs can recover an unexpired password-session token and reuse it to obtain administrator authority.

Evidence

• Source/control: Cookie or Bearer session credentials on administrator HTTP requests.
• Sink/decision: The debug logger formats request.headers into its message without removing credentials.
• Missing mitigation: Credential-bearing headers are not removed before they become an unstructured log message. The logger has no redaction that protects these embedded values.

Suggested fix. Log an explicit selection of non-sensitive request fields. Remove Cookie, Authorization, and other credential-bearing headers before formatting any request diagnostics.

Finding F-017 of 43 in the scan. The other findings are filed as separate issues by area.